Legal
Privacy and cookies
We collect little, keep it briefly and never sell it to anyone. This page sets out exactly what we process, why, and for how long.
- Analytics
- Only with your consent
- Advertising
- No advertising cookies
- Enquiries
- To reply and quote
- Selling data
- Never
Who handles your data
The data controller for emnaweb.com is:
- Name
- EMNA Web Solutions
- Location
- Croatia
- info@emnaweb.com
For any question about privacy, write to us at that address.
Enquiries through the planner and by email
When you send an enquiry through the project planner, we process what you enter yourself: your name, email address, company and phone number if you give them, the project description, and the services, budget range and timeline you pick. We also note the language of the page and when it was sent. When you email us directly, we process what is in your message.
The enquiry reaches us as an email in our inbox (delivered by Resend) and is stored in our enquiry database at Neon, on servers in Frankfurt (EU). Only we access it there, to reply to you and, if you want one, to prepare a proposal. We don’t send you automated messages or a newsletter.
While you fill in the planner, a draft is kept only in your browser, so nothing is lost if you close the tab. It is never sent to us, and it is deleted as soon as you send the enquiry or clear the fields.
- Purpose
- Replying to your enquiry and, if you want one, preparing a proposal.
- Legal basis
- Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and the consent you give in the planner (Art. 6(1)(a)).
- Kept for
- While we discuss the project, and no longer than 12 months after the last message if we don’t start working together. If we do, for the length of the contract and as long as accounting and tax rules require.
Proposals
A proposal we send you opens on its own link on emnaweb.com. It contains the details you gave us for it: your name, company, email address, and your company’s address and VAT ID if you provide them, together with the content and prices of the proposal. The link is random and secret, search engines don’t index it, and on request we replace it with a new one at once.
We record when the proposal is opened (first and last opening and the number of openings), so we know it arrived. So that one opening isn’t counted twice, your browser keeps a marker in session storage, which disappears when you close the tab.
When you accept a proposal, we record the name you type, the time of acceptance and a digest (cryptographic hash) of your IP address, as evidence of the acceptance. We don’t store the IP address itself. If you decline, we record the time and your reason, if you give one. Proposals are stored in the same database as enquiries (Neon, Frankfurt).
- Purpose
- Preparing, sending and following up a proposal, and evidence of its acceptance.
- Legal basis
- Steps taken at your request before entering into a contract, and performance of the contract (Art. 6(1)(b) GDPR); recording openings and the IP digest relies on our legitimate interest in knowing that the proposal arrived and being able to prove its acceptance (Art. 6(1)(f)).
- Kept for
- A proposal that was not accepted is deleted 12 months after its last change and the end of its validity. An accepted proposal is kept as part of the contract records, for as long as we work together and as the law requires; on request we remove the details no longer needed (email address, address, IP digest).
Analytics: Google Analytics 4
To see which pages people read and where they leave, we use Google Analytics 4. Its cookies are set only once you choose “Accept” in the cookie bar. Until you do, or if you choose “Decline”, no analytics cookie is stored on your device.
With your consent, Google Analytics records which pages you open, where you came from, your type of device and browser, and your approximate location (country and city). Google Analytics 4 does not log or store IP addresses. When you send an enquiry, we record only that it was sent, with the type of service and the budget range: no name, email address or message text.
We use Google’s Consent Mode v2 in its basic form: until you choose “Accept”, Google’s script is not loaded at all and nothing is sent to Google. The same applies if you choose “Decline”. Advertising signals stay denied even with your consent.
The advertising settings (ad_storage, ad_user_data and ad_personalization) are always denied, so data from this site is never used for advertising or remarketing.
You can withdraw consent as easily as you gave it: with the “Cookie settings” button at the bottom of every page, or right here. From then on Google Analytics no longer reads or writes its cookies; you can delete any existing ones in your browser settings.
- Purpose
- Understanding how the site is used, so we can improve it.
- Legal basis
- Your consent (Art. 6(1)(a) GDPR and the cookie rules of the Croatian Electronic Communications Act).
- Kept for
- Google Analytics keeps user and event data for 2 months. Analytics cookies last up to 2 years.
Cookies and local storage
Apart from the analytics cookies Google Analytics sets with your consent, we use only what is needed for things you asked for yourself. We don’t ask for consent for those.
Local and session storage (localStorage and sessionStorage) stay on your device and are never sent to us. You can clear them in your browser settings.
_ga- Purpose
- Google Analytics: tells visitors apart.
- Duration
- 2 years
- Type
- Cookie, analytics, with consent
_ga_4N01TQYD2L- Purpose
- Google Analytics: keeps track of the current visit.
- Duration
- 2 years
- Type
- Cookie, analytics, with consent
emna-consent- Purpose
- Your choice in the cookie bar.
- Duration
- Until you clear it
- Type
- Local storage, essential
emna-motion- Purpose
- Your animation setting, if you changed it.
- Duration
- Until you clear it
- Type
- Local storage, essential
emna-planner-draft- Purpose
- An unsent draft from the project planner.
- Duration
- Until you send it or clear the fields
- Type
- Local storage, essential
emna-offer-viewed:…- Purpose
- On a proposal page: so that one opening isn’t counted twice.
- Duration
- Until you close the tab
- Type
- Session storage, essential
Hosting and server logs
The site is served by Vercel. Like any web server, it processes technical data on every visit: IP address, browser type, the address requested and the time. It needs these to deliver the site and protect it from abuse.
We serve our typefaces and images from our own domain, so your browser does not connect to Google Fonts or any other service to load them.
- Purpose
- Delivering the site, keeping it secure and fixing errors.
- Legal basis
- Our legitimate interest in running the site securely and correctly (Art. 6(1)(f) GDPR).
- Kept for
- Briefly, under the hosting provider’s own rules.
Who receives your data
We don’t sell your data or pass it to anyone for their own purposes. Only these processors handle it, on our instructions:
Vercel Inc., USA
- Role
- Hosting and delivering the site
- Data
- Server logs
Neon, USA
- Role
- Database for enquiries and proposals, servers in Frankfurt (EU)
- Data
- Enquiries and proposals
Google Ireland Limited, Ireland
- Role
- Google Analytics 4, only with consent
- Data
- Site usage data
Resend, USA
- Role
- Delivering planner enquiries by email
- Data
- Enquiry contents
Vercel, Google, Resend and Neon may also process data in the United States. Such transfers rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.
Your rights
At any time, you can ask us for:
- Access · what data we hold about you and what we do with it (Art. 15)
- Rectification · of inaccurate or incomplete data (Art. 16)
- Erasure · of data we no longer need or have no valid basis to process (Art. 17)
- Restriction · of processing while a disputed point is resolved (Art. 18)
- Portability · of the data you gave us, in a machine-readable format (Art. 20)
- Objection · to processing based on legitimate interest (Art. 21)
- Withdrawal of consent · at any time, without affecting the lawfulness of processing before you withdrew it (Art. 7(3))
Send your request to info@emnaweb.com. We reply without delay, and within one month at the latest. We may ask you to confirm your identity, so that we never disclose data to the wrong person.
Complaints to the supervisory authority
If you believe we process your data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.
We’d gladly try to resolve it with you directly first, so feel free to get in touch.
Other
- We make no decisions based solely on automated processing, and we don’t profile visitors.
- The site works only over an encrypted connection (HTTPS).
- When something changes, we update this page and the date at the top.